CVE-2026-94579 is a high severity (CVSS 8.0) OS command injection in the session cleanup of Brocade Fabric OS before 9.2.2d, and 10.0.0 through 10.0.0a1. A user from an external directory whose name contains shell metacharacters can run commands as root when their SSH session ends.
What's affected
The record lists Fabric OS before 9.2.2d, and 10.0.0 through 10.0.0a1. The weakness is CWE-78, OS command injection.
The flaw sits in the PAM session cleanup routines that run at SSH session termination. According to the record, an authenticated user who signs in through an external directory or AAA service, and whose username or profile identifier contains shell metacharacters, can trigger arbitrary command execution with root privileges when the session closes.
The CVSS vector is adjacent network, low complexity, low privileges, and high impact. I could not load Broadcom's advisory and will not describe more than the record does. Use the advisory for the fixed build.
How to check if you're exposed
Read the Fabric OS version on each switch from its command line.
version
firmwareshow
Compare the result with the ranges in the record. The record's ranges are before 9.2.2d, and 10.0.0 through 10.0.0a1.
Because the advisory pages need a browser session, open the Broadcom advisory in your own support account to see the fixed builds for your hardware and train. Record the version of every switch, including those in remote sites and lab fabrics, since fabrics are often managed by a different team than the servers they serve.
Then check whether the switch authenticates users against an external directory.
aaaconfig --show
If only local accounts are used, the described condition is harder to meet, but plan the upgrade anyway. If a directory is used, review which names it can contain.
What to do now
- Open Broadcom advisory 39147 and apply the fixed Fabric OS build.
- Review which accounts can authenticate through the external directory and who can create or rename them.
- Enforce a strict allowed character set for usernames in the directory, as a defense in depth measure while you wait for the upgrade.
- Restrict SSH access to the switches to a management network and named hosts.
- Check switch logs for odd account names and for unexpected activity at session close.
Why it matters
Username strings come from outside the switch, and any value that crosses into a shell command has to be handled as data, not as syntax. CWE-78 arises when it is not: characters that mean something to the shell are carried through and obeyed. What makes this case notable is the timing. The command runs at cleanup, in a privileged context, long after the login checks have passed.
The record does not mark exploitation, and the CVE is not in CISA's catalog. The condition of a directory user with a crafted name is an administrative control. Whoever can create names in your directory has influence over this bug.
Quick check
Why does it run as root?
The record says the cleanup routines run with root privileges when the SSH session terminates.
Do local accounts matter here?
The record describes users who authenticate through an external directory or AAA service. Check the advisory for details on other account types.
Sources
Last reviewed: 18 October 2026.
